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REMARKS 

Claims 39-56 and 58 are presented for examination in view of the foregoing amendments 
and following remarks. 

By this Amendment, claims 39, 40, 44-49 and 53-56 have been amended. Claim 57 has been 
cancelled without prejudice or disclaimer to the content therein. Claim 58 is newly presented. In this 
regard, Applicants note that the amended claims merely clarify the subject matter recited in the 
claims, but do not narrow the scope of the claims. Claims 41-43 and 50-52 remain unchanged. 

Independent claims 39 and 48 have been amended to more clearly define the contribution of 
some embodiments of the claimed subject matter. Amended claim 39 is directed to an apparatus for 
monitoring and auditing activity in a network, including an analyzer, a mirror manager and an audit 
event analyzer. Thus, as supported by the specification and original claim, the amendments so that 
"[T]he mirror manager is configured to generating mirror data" (emphasis added) and the audit event 
analyzer is "responsive to said mirror data" in lieu of "processing at least part of said data 
representative of a mirror session" are self-explanatory and effected only for clarity and ease of 
reading. Similarly, the phrase "data representative of audit events," has been replaced by the term 
"event data," which is believed to be clearer. 

Support for other amendments to claim 38 is provided in the original specification at least 
on page 21, lines 16-22 "[d]ata representative of a screen includes, for example, field to be 
displayed on the terminal, their respective attributes. . .additional characteristics (such as position 
on the screen. . ." Further support is provided, e.g. by Figures 6 A, 6B, 6C and 6D, wherein the 
detailed description beginning on page 24, line 1 teaches that "Fig. 6C illustrates ...data 
representative of the outbound audit event of Fig. 6A. In the figure... every occurrence of "11 xx 
yy means" that the position of the field is calculated based on xx and yy. For example, 1 1 40 40 
means position row 1 column 1 on the screen. Every occurrence of "Id zz" means a new field in 
this location and its attributes described by zz." Then, "Fig. 6D illustrates. . .data representative of 
the inbound audit event including data illustrated in Fig. 6B . . . In this example. . . "C6 7B" is the 
cursor position; and the rest are instructions to put specific data representative of part of the screen 
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in specific locations." Page 28, line 29 to page 29, line 2 of the original specification further 
teaches that "a new audit event is generated. . . combining data representative of the outbound 
audit event and data representative of information inserted in the inbound audit event." Indeed, 
page 24, lines 16-1 8 of the original specification states "Fig. 6E illustrates. . .data representative of 
the united audit of Fig. 6B. It should be appreciated that 6E01 is similar to 6C01, but include the 
data of 6D01." In addition, "extracting extracted data from event data representative of an 
inbound audit event" is supported by page 27, lines 7-10 of the original specification teaching that 
"...it is required to analyze the audit event; extract conveyed information therefrom. . ." 

The amendments to claim 38 discussed above have been mirrored where appropriate in 
amendments to independent claim 48. Accordingly, claims 40, 44-47 and claims 49 and 53-56 have 
also been amended to reflect the clearer terms "event data" and "mirror data." 

The subject matter of newly presented claim 58 was divided from previously presented claim 
1; thus claim 58 is supported by the original disclosure. 

The amendments to the claims have been made to further prosecute the application. It is 
respectfully submitted that the above amendments do not introduce any new matter to this application. 
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